Unattributed Code Systems

• http://johnmoehrke.github.io/xacml-consent/CodeSystem/cs-health-sensitivity
• http://loinc.org
• http://unstats.un.org/unsd/methods/m49/m49.htm
• urn:ietf:rfc:3986

Copyright Fragment

This fragment is available on index.html

Copyright and Registered Trademark Uses

• IG © 2021+ John Moehrke (Moehrke Research LLC). Package johnmoehrke.xacml-consent.example#0.1.0 based on FHIR 4.0.1. Generated 2026-01-17 Links: Table of Contents | QA Report ( src )
• hl7.fhir.us.hai: Healthcare Associated Infection Implementation Guide ®© HL7 | CC0 ( src )
• <!-- This XACML policy file defines an organizational governance layer that overrides patient consent preferences. Specifically: Purpose: It demonstrates how an organization's data access rules take precedence over patient consent policies using XACML's "deny-overrides" combining algorithm. Key Rules: 1. Emergency Access - Permits doctors to access data during life-safety emergencies, regardless of consent restrictions 2. Archived Data Denial - Strictly forbids access to archived records, overriding any patient permits 3. Administrative Staff Restriction - Denies administrative staff access to data tagged as "Restricted" (R), even if patient consent would allow it Context: This sits within a larger governance framework where patient consent (referenced via PolicySetIdReference) is evaluated, but organizational policies can override patient preferences when necessary for clinical workflows, safety, or compliance reasons. A master container applies default-deny if neither permits nor denies are found. --> ( src )
• <!-- This XACML policy file defines an organizational governance layer that overrides patient consent preferences. Specifically: Purpose: It demonstrates how an organization's data access rules take precedence over patient consent policies using XACML's "deny-overrides" combining algorithm. Key Rules: 1. Emergency Access - Permits doctors to access data during life-safety emergencies, regardless of consent restrictions 2. Archived Data Denial - Strictly forbids access to archived records, overriding any patient permits 3. Administrative Staff Restriction - Denies administrative staff access to data tagged as "Restricted" (R), even if patient consent would allow it Context: This sits within a larger governance framework where patient consent (referenced via PolicySetIdReference) is evaluated, but organizational policies can override patient preferences when necessary for clinical workflows, safety, or compliance reasons. A master container applies default-deny if neither permits nor denies are found. --> <Policy PolicyId= "Org_Policy_7890_Workflow_Governance" RuleCombiningAlgId= "urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides" xmlns= "urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" > <Description> Organizational Governance: Enforces workflow roles and clinical status. This policy overrides subject-level permits. </Description> <Target/> <Rule RuleId= "Emergency_Access_Permit" Effect= "Permit" > <Description> Allows doctors to access data regardless of tags during a life-safety event.</Description> <Condition> <Apply FunctionId= "urn:oasis:names:tc:xacml:1.0:function:string-equal" > <AttributeValue DataType= "http://www.w3.org/2001/XMLSchema#string" > Emergency</AttributeValue> <AttributeDesignator AttributeId= "urn:example:names:clinical:access-context" Category= "urn:oasis:names:tc:xacml:3.0:attribute-category:environment" DataType= "http://www.w3.org/2001/XMLSchema#string" MustBePresent= "true" /> </Apply> </Condition> </Rule> <Rule RuleId= "Deny_Archived_Data_Access" Effect= "Deny" > <Description> Strictly forbids access if the record is in 'Archived' status, overriding user permits.</Description> <Target> <AnyOf> <AllOf> <Match MatchId= "urn:oasis:names:tc:xacml:1.0:function:string-equal" > <AttributeValue DataType= "http://www.w3.org/2001/XMLSchema#string" > Archived</AttributeValue> <AttributeDesignator AttributeId= "urn:example:names:resource:status" Category= "urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType= "http://www.w3.org/2001/XMLSchema#string" MustBePresent= "true" /> </Match> </AllOf> </AnyOf> </Target> </Rule> <Rule RuleId= "Deny_Non_Clinical_Staff_Restricted" Effect= "Deny" > <Description> Forbids administrative staff from seeing any data tagged as 'Restricted' (R).</Description> <Condition> <Apply FunctionId= "urn:oasis:names:tc:xacml:1.0:function:and" > <Apply FunctionId= "urn:oasis:names:tc:xacml:1.0:function:string-equal" > <AttributeValue DataType= "http://www.w3.org/2001/XMLSchema#string" > Administrative</AttributeValue> <AttributeDesignator AttributeId= "urn:oasis:names:tc:xacml:2.0:subject:role" Category= "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType= "http://www.w3.org/2001/XMLSchema#string" MustBePresent= "true" /> </Apply> <Apply FunctionId= "urn:oasis:names:tc:xacml:1.0:function:string-equal" > <AttributeValue DataType= "http://www.w3.org/2001/XMLSchema#string" > R</AttributeValue> <AttributeDesignator AttributeId= "urn:example:med:names:resource:data-tag" Category= "urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType= "http://www.w3.org/2001/XMLSchema#string" MustBePresent= "true" /> </Apply> </Apply> </Condition> </Rule> </Policy> ( src )
• <!-- This XACML policy file encodes a patient consent for Patient ID 12345. Specifically: Purpose: Defines the patient's preferences for data sharing based on sensitivity tags using Attribute-Based Access Control (ABAC). Consent Rules: 1. Permits Normal Data - Allows sharing of data tagged as "Normal" (N) sensitivity 2. Denies Restricted Data - Blocks sharing of data tagged as "Restricted" (R) sensitivity How it Works: - Targets requests where the subject-id matches patient 12345 - Uses "deny-overrides" at the PolicySet level to ensure denials take precedence - Contains two sub-policies: one for Normal data (permit-overrides) and one for Restricted data (deny-overrides) - Evaluates the data-sensitivity attribute on resources to determine access - This represents the patient's preferences layer in the consent framework, which works in conjunction with organizational policies (like xacml-overriding.xml) to make final access decisions. --> ( src )
• <!-- This XACML policy file encodes a patient consent for Patient ID 12345. Specifically: Purpose: Defines the patient's preferences for data sharing based on sensitivity tags using Attribute-Based Access Control (ABAC). Consent Rules: 1. Permits Normal Data - Allows sharing of data tagged as "Normal" (N) sensitivity 2. Denies Restricted Data - Blocks sharing of data tagged as "Restricted" (R) sensitivity How it Works: - Targets requests where the subject-id matches patient 12345 - Uses "deny-overrides" at the PolicySet level to ensure denials take precedence - Contains two sub-policies: one for Normal data (permit-overrides) and one for Restricted data (deny-overrides) - Evaluates the data-sensitivity attribute on resources to determine access - This represents the patient's preferences layer in the consent framework, which works in conjunction with organizational policies (like xacml-overriding.xml) to make final access decisions. --> <PolicySet xmlns= "urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicySetId= "consent-policy-set-12345" Version= "1.0" PolicyCombiningAlgId= "urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:deny-overrides" > <Description> Consent Policy Set for Patient ID 12345</Description> <Target> <AnyOf> <AllOf> <Match MatchId= "urn:oasis:names:tc:xacml:1.0:function:string-equal" > <AttributeValue DataType= "http://www.w3.org/2001/XMLSchema#string" > 12345</AttributeValue> <AttributeDesignator AttributeId= "urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category= "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType= "http://www.w3.org/2001/XMLSchema#string" MustBePresent= "true" /> </Match> </AllOf> </AnyOf> </Target> <Policy PolicyId= "consent-policy-12345-normal-data" RuleCombiningAlgId= "urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides" > <Description> Policy to permit sharing of Normal (N) data</Description> <Target> <AnyOf> <AllOf> <Match MatchId= "urn:oasis:names:tc:xacml:1.0:function:string-equal" > <AttributeValue DataType= "http://www.w3.org/2001/XMLSchema#string" > Normal</AttributeValue> <AttributeDesignator AttributeId= "data-sensitivity" Category= "urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType= "http://www.w3.org/2001/XMLSchema#string" MustBePresent= "true" /> </Match> </AllOf> </AnyOf> </Target> <Rule RuleId= "permit-normal-data" Effect= "Permit" > <Description> Permit access to Normal data</Description> </Rule> </Policy> <Policy PolicyId= "consent-policy-12345-restricted-data" RuleCombiningAlgId= "urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides" > <Description> Policy to deny sharing of Restricted (R) data</Description> <Target> <AnyOf> <AllOf> <Match MatchId= "urn:oasis:names:tc:xacml:1.0:function:string-equal" > <AttributeValue DataType= "http://www.w3.org/2001/XMLSchema#string" > Restricted</AttributeValue> <AttributeDesignator AttributeId= "data-sensitivity" Category= "urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType= "http://www.w3.org/2001/XMLSchema#string" MustBePresent= "true" /> </Match> </AllOf> </AnyOf> </Target> <Rule RuleId= "deny-restricted-data" Effect= "Deny" > <Description> Deny access to Restricted data</Description> </Rule> </Policy> </PolicySet> ( src )
• John Moehrke XACML Consent Example, published by John Moehrke (Moehrke Research LLC). This guide is not an authorized publication; it is the continuous build for version 0.1.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/JohnMoehrke/xacml-consent/ and changes regularly. See the Directory of published versions ( src )
• This material contains content from LOINC. LOINC is copyright © 1995-2020, Regenstrief Institute, Inc. and the Logical Observation Identifiers Names and Codes (LOINC) Committee and is available at no cost under the license. LOINC® is a registered United States trademark of Regenstrief Institute, Inc. Show Usage * LOINC: Consent/Consent-AB352-Example, Consent/Consent-AB352-Example-AllowAll... Show 6 more , Consent/Consent-AB352-Example2, Consent/ExampleFHIRConsentXACMLcopy, Consent/ExampleFHIRConsentXACMLreference, DocumentReference/xacml-patient-consent-12345, FHIRConsentXACML and VS_Contraception_AI ( src )
• This material derives from the HL7 Terminology (THO). THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html Show Usage * Consent Scope Codes: Consent/Consent-AB352-Example, Consent/Consent-AB352-Example-AllowAll... Show 4 more , Consent/Consent-AB352-Example2, Consent/ExampleFHIRConsentXACMLcopy, Consent/ExampleFHIRConsentXACMLreference and FHIRConsentXACML * ActReason: Consent/Consent-AB352-Example, Consent/Consent-AB352-Example-AllowAll, Consent/Consent-AB352-Example2 and Patient/ex-patient * Confidentiality: Consent/Consent-AB352-Example, Consent/Consent-AB352-Example-AllowAll and Consent/Consent-AB352-Example2 ( src )

External References

Type	Reference	Content
web	example.org	patient : http://example.org/Patient/example
web	example.org	organization : Example California Hospital
web	example-hospital.org	https://example-hospital.org
web	example.org	http://example.org/policies/xacml-overriding.xml
web	snomed.info	169745008
web	snomed.info	386761002
web	snomed.info	304527002
web	snomed.info	169472004
web	johnmoehrke.github.io
web	github.com	John Moehrke XACML Consent Example, published by John Moehrke (Moehrke Research LLC). This guide is not an authorized publication; it is the continuous build for version 0.1.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/JohnMoehrke/xacml-consent/ and changes regularly. See the Directory of published versions
web	healthcaresecprivacy.blogspot.com	IG © 2021+ John Moehrke (Moehrke Research LLC) . Package johnmoehrke.xacml-consent.example#0.1.0 based on FHIR 4.0.1 . Generated 2026-01-17 Links: Table of Contents | QA Report
web	providerlibrary.healthnetcalifornia.com	Reference: Wellcare/Health Net Bulletin 24-351
web	providerlibrary.healthnetcalifornia.com	Reference: Pregnancy Termination - Health Net Provider Library
web	providerlibrary.healthnetcalifornia.com	Direct Link to the Document: 500073-Abortion-DX-Code-List.pdf
web	providerlibrary.healthnetcalifornia.com	Health Net Bulletin 24-351: New Laws Help Safeguard Privacy ( View Link )
web	providerlibrary.healthnetcalifornia.com	Health Net Medi-Cal Provider Manual (Chapter 4): Sensitive Services section ( Link to Manuals )
web	snomed.info	169745008
web	snomed.info	386761002
web	snomed.info	304527002
web	snomed.info	169472004
web	providerlibrary.healthnetcalifornia.com	Health Net's bulletin 24-351 explicitly tells providers that services defined in policies like HNCA.CP.MP.496 must be:
web	providerlibrary.healthnetcalifornia.com	Direct PDF Link: HNCA.CP.MP.496 - Gender Affirming Procedures
web	en.wikipedia.org	Shows how a Consent resource can use XACML policy sets to express the patient specific rules and the organization specific rules
web	github.com	The source code for this Implementation Guide can be found on GitHub

Internal Images

tree-filter.png